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The development of flight control systems to enhance aircraft safety during periods of 
vehicle impairment or degraded operations has been the focus of extensive work in recent 
years. Conditions adversely affecting aircraft flight operations and safety may result from a 
number of causes, including environmental disturbances, degraded flight operations, and 
aerodynamic upsets. To enhance the effectiveness of adaptive and envelope limiting controls 
systems, it is desirable to examine methods for identifying the occurrence of anomalous 
conditions and for assessing the impact of these conditions on the aircraft operational limits. 
This paper describes initial work performed toward this end, examining the use of fault 
detection methods applied to the aircraft for aerodynamic performance degradation 
identification and model-based methods for envelope prediction. Results are presented in 
which a model-based fault detection filter is applied to the identification of aircraft control 
surface and stall departure failures/upsets. This application is supported by a distributed 
loading aerodynamics formulation for the flight dynamics system reference model. 
Extensions for estimating the flight envelope due to generalized aerodynamic performance 
degradation are also described. 


I. Introduction 

T ECHNOLOGY advancements have resulted in significant reductions in fatal aircraft accidents in recent years, 
although it is always desirable to seek cost-effective ways to further enhance aviation safety. With the expected 
growth in air traffic capacity as part of the Next Generation Air Transportation System (NextGen), improving the 
inherent safety for all aircraft operations has been and continues to be an active area of research and development. 
To have continuing impact on safety, improvements must address the leading causes of aircraft accidents, which 
historically have been controlled flight into terrain (CFIT) and loss of control in-flight (LOC-I). Aircraft accident 
data surveys have shown that LOC-I accidents between 1987 and 2005 have resulted in more than 2800 fatalities 
worldwide 1,2 . While there may be several contributing factors in any single LOC-I accident, the primary causes can 
be attributed to environmental effects (including both atmospheric and man-made disturbances, such as wake vortex 
encounters, as well as aircraft icing), subsystem degradation, equipment malfunctions and failures, and piloting 
error. 

While effective pilot training can reduce fatal accident rates associated with LOC-I, flight control developments 
provide a parallel path for enhancing aircraft safety, in particular when the aircraft is subject to vehicle impairment 
and/or anomalous flight conditions. Specifically, it is desirable to develop estimation and identification methods to 
identify/diagnose anomalous conditions and to determine appropriate recovery commands, which can consist of 
pilot indicators/guidance cueing and/or active feedback/feedforward commands. Some research and development 
that has been performed in recent years toward this end includes (1) fault detection, isolation, and reconfiguration 
(FDIR) methods for identifying failures in critical flight control components, such as sensors and actuators, and 
providing reconfiguration to maintain sufficient closed-loop functionality 3 " 6 ; (2) envelope limiting control systems 
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where corrective commands are generated as operational limits are approached to prevent excursions into potentially 
dangerous flight regimes 7 " 9 ; and (3) adaptive control methods where feedback/feed-forward commands are 
determined to counteract changes in the aircraft system and/or operational environment 10,11 . Note that this (brief) 
literature survey is not intended to be comprehensive but is used to indicate the diversity of research and 
development that has addressed flight control approaches for improving aircraft safety, in particular during degraded 
flight operations. 

Adaptive control technology specifically has received much attention in recent years given its potential for 
providing resiliency to aircraft system degradation and impairment. Recent flight test demonstrations have shown 
the potential for improved safety but have also highlighted some potential issues. Specifically, control adaptation 
schemes may be sensitive to initial pilot reactions following a subsystem failure, which can cause the adaptive 
controller gains to “over-correct” and/or introduce side effects (in the cross-coupling control/response axes). This 
behavior was observed in Ref. 10, where the roll axis gains for a precision (pitch axis) tracking task following the 
failure of one stabilator introduced the tendency for a pilot induced oscillation in one piloted evaluation case. While 
adaptive control technology offers flexibility, it should be recognized that performance/robustness of the overall 
system may be improved with outer-loop “supervision” from a system that diagnoses potential impairment in 
parallel with recovery command generation. This supervision can be used to direct adaptively generated command 
responses and/or to protect against limit exceedances, which may be radically different for an aircraft that has 
experienced degradation of one or more critical subsystems. 

One approach to enhance the effectiveness of adaptive/envelope limiting flight control systems during vehicle 
impairment is to incorporate an on-board aircraft flight envelope estimation system in an outer “supervisory” loop. 
A notional system is illustrated in Fig. 1. On-board flight envelope estimation requires methods for identifying and 
isolating anomalous 

conditions and/or vehicle 
impairment (aerodynamic 
performance monitoring) 
that can be used to 
diagnose the impact of 
identified aircraft 

degradation with respect to 
operational restrictions. 

Output from the envelope 
estimation system can be 
used to augment control 
loop and/or limit protection 
gains to ensure that control 
adaptation for the degraded 
aircraft does not 
inadvertently lead to more 
dangerous flight conditions. 

Output may also feed 
guidance command 

generation to assist in 
safely landing the 
(impaired) aircraft. 


Environmental or 
degraded ops ~ 
disturbance 



Figure 1. Illustration of Notional On-board Envelope Estimation System as 
part of an Outer Loop Intelligent Flight Control System 


In the following sections of this paper, results from proof-of-concept research and development work are 
described that examine several aspects of an on-board flight envelope estimation system. Specific areas discussed 
include the application of fault detection methods applied to the whole aircraft to perform aerodynamic performance 
and degradation monitoring. The application of a model-based approach for determining the flight envelope subject 
to vehicle impairment is also provided. Considerations for on-board implementation of an envelope estimation 
system are discussed, followed by conclusions from this initial work and areas for future development. 


II. Fault Detection Methods for Aircraft Performance Degradation Monitoring 

The need for reliable methods for fault detection has grown with the increasing complexity of many aerospace 
systems and the need for reliable operations in potentially challenging environments. The survey paper 6 provides an 
overview of various FDIR techniques that have been examined over the past decades, with a focus toward model- 
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based methods that include robust residual generation and statistical decision techniques, in addition to controller 
reconfiguration methods to accommodate failures when detected. While a broad range of methods have been 
examined for performing fault diagnostics, model-based methods have the benefit of providing fault diagnostic 
capabilities with reduced sensing requirements. One class of fault detection methods is based on the use of linear 
filters - referred to as fault detection filters (FDF) - tailored to identify one or more pre-postulated failure 
modes 12,13 . The FDF approach (also referred to as the Beard- Jones FDF) provides a means to perform fault 
detection and isolation using a full state linear observer. The Beard-Jones FDF approach was later extended by 
Messerole for nonlinear systems 14 . An 
extensive body of literature exists that 
considered many aspects of the design and 
application of filters that have been tailored 
to respond to pre-defmed faults 15 " 18 . 

Development of a fault detection filter for 
a particular application, whether for 
identifying component failures or for 
aerodynamic performance degradation as 
outlined below, follows a similar 
development strategy for gain selection. The 
main feature of the method consists of 
constructing a state estimator for the dynamic 
system (see Fig. 2) that selects a feedback 
gain on the measurement residual to make the 
overall estimator sensitive to pre-specified 
types of system failures (modes). The magnitude of the residual, which should be zero under normal conditions, 
indicates the departure of the system from some pre-postulated reference model, due to a failed sensor, actuator, or 
an unexpected disturbance affecting the dynamic system. The detection filter reference model is formulated as a 
linear perturbation model, where in state space form is given as follows: 


Actual 

sensor 

outputs 



Figure 2. Fault Detection Filter (FDF) Structure for Aircraft 
Fault (Upset) Detection 


x = Ax + Bu + I>T) 
y = Cx + Du 


( 1 ) 


where x is the aircraft state vector, u is a vector of control inputs, and ( A , B , C , D ) are the linearized system 
matrices that include terms due to both aerodynamic and inertial effects. The last term in the state rate equation 
represents the disturbances to the system response that are associated with the aircraft upset state. Note that the 
constant vector fj represents an additive disturbance to the system and is sometimes referred to as the event vector 
associated with a particular failure mode, and n^t) is an arbitrary (scalar) time history. The objective of the 
detection filter is to choose a full-state observer gain matrix H , i.e., 

x = Ax + Bu + H(y — y) 
y = Cx + Du 


where x and y are the estimates of the state and output vector so that the filter residual r , defined as: 

r = R(y-y) (3) 

maintains a fixed direction in output space (R is a feed-forward gain matrix that decouples the residual response). 
Through careful selection of the gain matrices, one may force the measurement residual to remain fixed in a 
particular direction or a specific plane for a given failure (upset) mode. Note that the review given in Ref. 6 
provides additional discussion of alternative methods for residual generation. 

While commonly used for detecting and isolating component faults, FDF methods have been previously applied 
to aerodynamic performance degradation, such as aircraft icing 19 ' 21 . In Ref. 21, a FDF-based algorithmic approach 
to detect icing conditions was developed for the V-22 tiltrotor aircraft. This approach used a Beard-Jones FDF to 
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identify and distinguish icing “fault modes” in flight measurements from normal flight operations. This approach 
provided a method to determine not only if aircraft icing occurred but also the region of the aircraft (wing or 
proprotor) where significant ice accretion existed. Representative results from this application of fault detection 
methods to icing detection are illustrated in Fig. 3. 



Figure 3. Representative Results for V-22 Aircraft Icing Simulation and FDF-based Icing Detection System; 
Top - Flow field and droplet trajectory simulation; Bottom - Icing detection filter output. 


This approach for aerodynamic performance monitoring has been recently extended to identify the onset of an 
aircraft upset condition. In this application, pre-postulated upset conditions, such as a stall departure, may be treated 
as an additional disturbance to the (linear) reference model used to formulate the detection filter. The development 
of an upset detection filter (UDF) follows from the procedure outlined above. With sufficient available 
measurements, it should be possible to identify aerodynamic degradation and upset conditions, in addition to control 
surface failures, as part of an overall performance monitoring system. Results presented in the following section 
describe initial work performed to demonstrate this application. 


III. Aircraft Fault/Upset Detection Development and Demonstration 

An overview of initial work on the application of fault detection methods for identifying component failures and 
the onset of aerodynamic upset conditions is described. This work applied the UDF approach to a small radio- 
controlled aircraft, which was used to obtain flight test data for evaluating the concept. 

A. Flight Test Summary 

Flight test data were acquired for a small, unmanned radio-controlled aircraft for evaluation of the UDF 
approach. The flight test vehicle was the Great Planes Siren commercial almost ready-to-fly (ARF) aircraft (Fig. 4). 
This aircraft has been used previously as a demonstration platform for a number of applications including 
distributed, smart material-based actuation concepts and evaluation of flight control and avionics systems. Data 
from this flight test activity also has been used for validating the distributed aerodynamics loading modeling 
approach described later in this paper 22 . 
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The test aircraft was instrumented 
with a custom instrumentation package 
that was used to examine sensor 
requirements for performing upset 
detection (and recovery). This 
instrumentation package (illustrated 
schematically in Fig. 5) consisted of the 
following components: a five degree of 
freedom (DOF) MEMS inertial 
measurement unit (IMU) consisting of a 
two-axis, vibrating mass rate gyro 
(InvenSense IDG-300) and a three-axis 
accelerometer (Analog Devices 
ADXL330); a patch-size GPS receiver 
(Grand Idea Studio/Parallax) with 1 Hz 
update rate; a 900 MHz radio 
transmitter/receiver telemetry link 
(MaxStream 9XStream) with 19.2 kbaud 
serial output capability; and two PIC 16F690 microcontroller units (MCU) that provided data sampling and serial 
output capabilities. Note that one microcontroller has been designated the master MCU, which provides analog-to- 
digital conversions of the IMU rate gyros (pitch and roll rate) and three-axis accelerometers, in addition to 
coordinating the serial output across a single “party line” through the telemetry link to the ground station. The other 
microcontroller has been dedicated to reading and parsing the NMEA sentences from the GPS receiver, providing 
output of the GPS satellite time, latitude, longitude, and altitude, as well as the course speed and heading. 



Figure 4. Great Planes Siren Radio Controlled Aircraft in Flight. 



Figure 5. Schematic Illustration of Flight Instrumentation Package. 

Several flights were performed to obtain data to define flight dynamics characteristics during nominal flight 
conditions and stall encounters. Data were also acquired during one flight with a gain reduction on the left aileron 
servo to simulate an actuator failure. Flights were typically performed with the aircraft velocity between 25 to 30 
knots (ground speed) and at approximately 100 to 200 feet altitude above ground level. Winds during flight tests 
were generally light and variable. 

Data were telemetered to the ground station and recorded continuously to file during each flight. Inputs from the 
radio controller were also recorded at the ground station to provide a measurement of the commanded control inputs 
to the aircraft. The ground station provided a real-time display of the altitude and ground speed from the GPS 
receiver. The time stamp from the GPS receiver was also displayed at the ground station monitor, which permitted 
logging of flight maneuvers for data analysis following the test flight. Note that latency was observed between 
commanded inputs and the aircraft response, which was believed to be caused by delays introduced by the radio 
uplink/downlink. This latency was removed as part of post- flight data analysis. 
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Representative flight data are shown in Figs. 6 and 7. Flight test data for a series of lateral pulse inputs, resulting 
in an “S-turn” maneuver, are shown in Fig. 6. Commanded control inputs are plotted as percentage of total control 
deflection, where zero corresponds to full left and full aft for the lateral and longitudinal control input. Figure 7 
shows flight test data for a power-off stall break (departure) maneuver. During this maneuver, the airspeed was bled 
off gradually until the aircraft pitched nose down and subsequently rolled to the left. The peak roll rate during the 
stall break was significant, reaching a maximum of approximately 150 deg/sec. Pilot recovery inputs were not 
immediately applied during this maneuver to provide data for the aircraft spin recovery characteristics. It was found 
that the aircraft demonstrated good stability characteristics in the post-stall regime. 





Time, sec 



Figure 6. Flight Test Data for S-Turn Lateral Input Maneuver. 
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Time, sec 

Figure 7. Flight Test Data for Stall Maneuver with Roll Break, 



B. Detection Filter Development 

The approach described previously was used to develop an UDF for identifying both component (control 
surface) failures and stall departure (upset). For this application, only output from the MEMS IMU was available 
(reconstruction of the full state vector from IMU and GPS measurements was not performed). Since available 
measurements were limited to accelerometer and angular rate measurements only, the UDF was developed using a 
third order reference model consisting of the fast rigid-body aircraft dynamics (i.e., the short-period pitch dynamics 
and roll convergence mode). Thus, the linearized reference model is structured as follows: 


x = Ax + Bu 
y = Cx + Du 


where the state vector consists of the roll rate, vertical velocity, and pitch rate: 

* T =\p W q] 


the control vector consists of the lateral and longitudinal control perturbations: 

» T =[ S lat 3 Ion ] 


and the measurement vector consists of the roll rate, pitch rate, and vertical acceleration: 

y T =[p q a z \ 
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The linearized system matrices are defined in terms of conventional stability derivatives as follows: 

L p 0 O' 

A = 0 Z w U Q 
0 M w M q 

Llat 0 
0 Z lon 
0 M lon_ 

'1 0 o' 

C= 0 0 1 

.0 z w 0_ 

0 o' 

D = 0 0 (5) 

_ Z lon 

where U Q is the trim longitudinal velocity and the remaining terms in Eq. (5) are the (dimensional) stability 
derivatives. Reference model parameters (stability derivatives) were determined from a nonlinear simulation of the 
aircraft using linear perturbation analysis around a 30-knot trim flight condition. 

Since the short period dynamics are affected by the aircraft lift curve slope (through the Z w stability derivative), 

it is possible to detect the onset of (asymmetric) stall conditions. A detection filter was developed to identify the 
onset of a stall departure, as well as an aileron servo failure. Development of the detection filter was done by 
selecting event vectors, i.e., the fj terms in Eq. (1), corresponding to these failure modes. For the stall departure 

mode, a suitable event vector was defined as a disturbance to the Z-force equation, i.e., fj all = [0 1 0]. The 

aileron servo failure event vector was defined similarly as a disturbance to the force and moment equations, 
although this failure mode involved coupling of all degrees of freedom and was aircraft configuration specific. The 
detection filter gains were determined using eigenstructure assignment design methods, where the remaining closed 
loop eigenvector was chosen to be orthogonal to the stall and servo failure modes to provide additional robustness. 
The feed-forward gain matrix R in Eq. (3) was determined to decouple the filter residuals and to scale the filter 
response to yield a common detection threshold for each upset mode. It was found that adjustments to the design 
feed-forward matrix were required to provide detection mode decoupling based on results from the flight test 
application. The final (single point) design was found to provide detection/isolation of both stall and servo failure 
modes, while allowing a detection threshold to avoid false positive trips due to maneuvering flight conditions. 

C. Results 

Results illustrating the performance of this third-order UDF with stall departure and servo failure modes are 
shown in Figs. 8 through 10. A detection threshold of ±2 is also shown, as indicated by dotted lines in each plot. 
This threshold was determined to provide failure/upset mode detection without false indications due to maneuvering 
in non-degraded flight conditions. Figure 8 illustrates the detection filter output for lateral S-tum maneuvers without 
failed servo (corresponding to Fig. 6). The filter residuals stay below the detection threshold during the maneuver, 
although each residual can be observed to approach the threshold for segments of the maneuver where maximum 
lateral control deflection is applied. This maneuver provides a significant test for the detection filter methodology, 
allowing bounds on the detection thresholds to be set to result in no false positive trips during aggressive 
maneuvering. 

Figure 9 illustrates the detection filter response for lateral maneuvering with failed aileron servo. Although the 
aileron servo was failed during the entire maneuver, the failed servo mode residual is observed to exceed the 
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Figure 8. Third Order UDF Output for Lateral S-Turn Maneuver. 



Figure 9. Third Order UDF Output for Lateral S-Turn Maneuver with Simulated Failed Aileron Servo. 



Figure 10. Third Order UDF Output for Stall Departure. 
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detection threshold only during segments of the maneuver when left stick is applied. The detection filter response is 
rapid once the roll rate has reversed direction. 

Figure 10 illustrates the detection filter response during the stall break encounter (shown in Fig. 7). For this 
case, the stall mode slowly increases in magnitude as airspeed is reduced and reaches a peak value at approximately 
13 seconds, at which point the aircraft experienced the rapid nose down acceleration as the aircraft stalls. For the 
selected filter gains, the stall mode magnitude exceeds the threshold several seconds before the stall departure 
occurred. Thus, corrective actions to prevent the stall could be performed prior to the actual break and roll entry. 

Results presented in this section demonstrate the feasibility of this algorithmic approach to detecting aircraft 
component faults and onset of upset conditions. These results were obtained with minimal on-board sensor 
requirements. The following sections of the paper discuss generalization of these initial results and application to 
envelope estimation. 

IV. Generalized Aerodynamic Performance Degradation and Envelope Estimation 

Results in the previous sections indicate that fault detection methods may be effectively applied to detection 
anomalous conditions affecting the overall aerodynamic performance of an aircraft. The FDF approach has 
advantages such as the ability to assess anomalous conditions with minimal sensing requirements. To serve as a 
foundation for an on-board envelope estimation system, however, it is necessary to examine methods to assess the 
impact of aircraft degradation on the overall aircraft performance and operational limits. Work toward this end is 
described below, focusing on model-based methods for detecting generalized aerodynamic performance degradation 
and for analytically determining the flight envelope. The approach is applied for lifting surface damage to a scaled 
unmanned aircraft as an example demonstration. 

A. Distributed Loading Model Formulation 

An analytical approach for envelope limit assessment has been examined based on a generic flight dynamics 
model formulation. This formulation calculates the distributed loading on the aircraft subject to control input and 
dynamic response characteristics, which is geometry-based in contrast to the conventional data-driven approach 
typically used in six degree of freedom simulations. This generic aerodynamic and flight dynamics modeling 
approach has been applied to a range of aircraft configurations with minimal input data requirements. This approach 
has been developed and documented previously 22 ; a brief summary is provided herein. 

The distributed loading model 
formulation provides a generic 
method for determining the 
aerodynamic loads on a complete 
aircraft configuration based on a 
component build-up approach. The 
approach is illustrated in Fig. 11, 
where lifting surfaces are discretized 
into elements where the local 
aerodynamic characteristics are 
approximated as two-dimensional. 

The sectional lift, drag, and pitching 
moment can be approximated as 
functions of the local angle of attack 
and flap/control surface deflection 
for low speed flight conditions. For 
each element, the local angle of 
attack is determined from the aircraft kinematics, planform geometry, and the induced velocity due to the generation 
of lift on the each surface. From the local angle of attack distribution across the lifting surface and control surface 
deflections, if present, the distributed aerodynamic forces (lift, drag, and moment) are calculated, resolved into the 
aircraft body axis reference frame, and integrated through summation to yield the total aerodynamic loads. 

Note that the distributed loading formulation (also commonly referred to as a strip theory method) forms the 
basis for at least one commercial flight simulation - X-plane by Laminar Research 23,24 . Distributed loading or strip 
theory methods are more commonplace in rotorcraft simulations, commonly referred to as blade element methods in 
the rotary- wing flight simulation community 25 . 


Lifting surfaces aero 
from multiple quasi-2D 
elements (“strip theory”) 



Fuselage aero 
included 
separately 


Unsteady wake from 
wing / lifting surfaces 


Local angle/aero from 
kinematics plus 3D 
downwash / sidewash 
correction (from wake) 

Figure 11. Illustration of Distributed Loading Aerodynamic Model 
for a Generic Aircraft Configuration. 
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An advantage of this modeling approach is that input data requirements, in particular aerodynamic data 
requirements, are greatly reduced. The primary input data includes geometric parameters and sectional aerodynamic 
data, in addition to other flight dynamics parameters such as mass properties, control system riggings, and 
propulsion system characteristics). Sectional aerodynamic data, including stall characteristics, are more easily 
defined than complete aircraft aerodynamic data. When formulating the aerodynamic loads based on two- 
dimensional sectional data, it is necessary to account for three-dimensional aerodynamic effects explicitly by 
including a model for the induced downwash and sidewash, which may consist of momentum-based and unsteady 
wake methods 22 . Momentum-based models are typically adequate for low angles of attack, whereas wake methods 
would be required to capture aerodynamic and interactional effects associated with large angles of attack and 
sideslip. Fuselage aerodynamic data are also required as part of the aerodynamic model build-up process, and these 
data can be derived from conventional stability and control methods (i.e., DATCOM), which are generally sufficient 
for small angles of attack and sideslip within the normal operating flight envelope. Note that strip theory methods 
generally have greater applicability to conventional fixed-wing aircraft configurations such as high aspect ratio 
aircraft that have been examined in this paper. Alternative aerodynamic modeling methods (e.g., vortex lattice 
models) would be required for more general applicability. 

B. Distributed Loading Model Benchmarking 

The distributed loading aerodynamic modeling approach has been applied to several aircraft to validate its 
effectiveness for capturing flight dynamics response characteristics. Recently, the model was applied to the NASA 
Langley Research Center (LaRC) Generic Transport Model (GTM) configuration as part of additional model 
benchmarking and validation. The present distributed loading model application used momentum-based methods 
for modeling the induced velocity rather than an unsteady wake model. 

The distributed loading model was applied within a 6 DOF flight dynamics model for the GTM configuration. 
This application included a model for the propulsive system, control system gearings and limiters, and actuator 
models, in addition to mass properties representative of the aircraft configuration. Since the airfoil cross-section 
was not available, generic sectional aerodynamic data were used. Some discrepancies between the LaRC GTM 
model, which includes polynomial fits for the 6 DOF static and dynamic aerodynamic data derived from wind tunnel 
testing, and the distributed loading model can be attributed to approximations made with the generic sectional data. 

Comparisons between the LaRC GTM and distributed loading models are shown in Figs. 12 and 13, illustrating 
trim characteristics and dynamic response characteristics, respectively. Initial results (identified as the “Baseline 
model”) indicated some discrepancies between models, and some semi-empirical corrections were applied to the 
distributed loading model. With corrections, the updated distributed loading model captures the trim characteristics 
(Fig. 12) predicted by the LaRC GTM model up to the stall speed. Predicted dynamic response characteristics 
(Fig. 13) are also in good agreement with distributed loading model corrections in place, although some minor 
discrepancies can be seen in the frequency and damping of the short period and Dutch roll modes. 



Airspeed, kts 



Figure 12. Comparison of Distributed Loading and LaRC GTM Models for Level Flight Trim. 
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Time, sec 

Figure 13. Comparison of Distributed Loading and LaRC GTM Models Aileron, Elevator, and Rudder 
Doublet Input Response Characteristics. 


C. Lifting Surface Damage Effects 

An objective has been to develop and apply a generic procedure for evaluating the impact of aircraft degradation 
on the dynamic flight envelope. This procedure for aerodynamic degradation modeling and envelope prediction was 
applied to lifting surface damage effects. Damage effects have been represented as alterations to the baseline 
geometric configuration, although more general application should account for localized changes in the sectional 
aerodynamic characteristics, such as reduction of the effectiveness of a partially damaged control surface. These 
effects are currently included and would require a more refined aerodynamic model to be implemented. 

Lifting surface damage effects are implemented in the distributed loading aerodynamic model as follows. For a 
given damage condition, parameterized in terms of a tip loss fraction, affected segments in the distributed loading 
formulation are identified and the corresponding distributed aerodynamic loads are adjusted based on a load 
reduction factor determined from the effective segment area. This approach allows for a continuous variation in the 
extent of the damaged surface, as well as allowing for localized effects, such as a hole in the lifting surface, in an 
approximate sense. Note that only the aerodynamic effects associated with damage to the lifting surfaces have been 
considered in results presented in this paper. Inertial effects, including center of gravity shift and change to the 
aircraft mass properties, have not been modeled but may be incorporated following the approach outlined in Ref. 26. 

This modeling approach was applied to the updated GTM distributed loading model and exercised for several 
hypothetical aircraft damage scenarios. Representative results illustrating the response due to instantaneous loss of 
the horizontal stabilizer tip are shown in Fig. 14. For these results, the aircraft is initially in a 70-knot level flight 
trim condition, and at 7 seconds into the simulation, the left outboard section of the horizontal tail is removed. No 
pilot recovery actions are applied following the damage condition. The effects of larger damage extents can be seen 
primarily as an increased reduction of damping of the short period mode, in addition to more significant coupling 
with the lateral-directional modes. Damage scenarios with wing damage have also been examined, with greater 
coupling between longitudinal and lateral-directional motions observed. 
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Time, sec 




Figure 14. Response Characteristics Following Instantaneous Damage (Tip Loss) to the Left Horizontal 
Stabilizer for GTM Distributed Loading Simulation in 70 kts Level Flight. 


Additional benchmarking has been performed for the distributed loading lifting surface damage model. 
Comparisons have been made with wind tunnel data for Ref. 27. The nature of the published data prevents direct 
correlation with model predictions. Instead, an alternative procedure is used to benchmark the distributed loading 
lifting surface damage model. Using similar modeling assumptions for the development of the generic distributed 
loading aerodynamic model, simplified analytical relationships for the lift curve reduction due to wing damage and 
pitch damping (short period stability) reduction due to horizontal stabilizer damage have been developed and are 
compared to wind tunnel data in Figs. 15 and 16, respectively. These analytical relationships have been developed 
using similar assumptions incorporated into the distributed loading model formulation. Agreement between model 
and data is relatively good for small damage extents, with better correlation observed for tail damage effects. 
Discrepancies between the predicted and observed lift curve reduction due to wing damage (Fig. 15) are likely due 
to approximations in representing non-uniform induced velocity effects. Discrepancies in the pitch damping 
(Fig. 16) may be cause by end-plating effects (which amount to a non-uniform interference effect between fuselage 
and tail surfaces) that are not modeled in the simplified analysis. These discrepancies may be addressed using 
improved aerodynamic modeling methods, such as vortex lattice models. 
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Figure 15. Comparison of Simplified Analytical Wing Damage Effects Model for Aircraft Lift Curve 
Reduction with Wind Tunnel Data (from Ref. 27) 



Figure 16. Comparison of Simplified Analytical Horizontal Tail Damage Effects Model for Aircraft Pitch 
Damping Reduction with Wind Tunnel Data (from Ref. 27) 

D. Flight Envelope Determination 

To determine the flight envelope of an aircraft, including accounting for degradation, it is necessary to consider 
several physical phenomena and limiting effects, including aerodynamic, structural and performance limits, 
controllability requirements, and stability margins, in addition to aircraft degradation effects. These effects need to 
be captured by the model and/or supporting data. 

To formulate the problem of the dynamic envelope determination in mathematical terms, a generalized solution 
procedure was identified to determine the achievable operational range of an aircraft, given its current aerodynamic, 
flight dynamic, and structural configuration, in addition to limits on the control range and aircraft state. One 
approach to this problem is the determination of the achievable aircraft trim conditions, in addition to the inclusion 
of provisions for maneuvering effects, given limits on the controls and aircraft state. This solution to the dynamic 
flight envelope determination has been examined in this investigation using a numerical solution for the generic 
aircraft trim problem 28,29 . A summary of the solution approach is outlined in the following steps: 

1 . The target aircraft (degraded) configuration and flight condition is specified, which is defined in terms 
of the aircraft velocity, flight path angle, and sideslip angle. Steady maneuvering conditions (load 
factor, turn rate) may also be considered. 
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2 . 


The aircraft control positions (surface deflections) and attitude are determined that result in non- 
accelerating flight (body- axis referenced). This solution is performed subject to aircraft limits, 
including the kinematic and dynamic constraints implicit to the aircraft model. 

3. The aircraft operational limits (dynamic envelope) are defined from trim maps that span the 
performance, control, and/or structural limit constraints to the general trim solution. 



Loading Model Including Angle of Attack (Stall) and Wing 
Damage Control Authority Limits 


This procedure for determining the dynamic flight envelope has been formulated in a series of Matlab functions. 

Application of this procedure was performed 
for the GTM aircraft subject to degradation 
resulting from damage to the aircraft lifting 
surfaces (wing and horizontal stabilizer). Results 
were derived from the distributed loading model 
with lifting surface damage effects. Figure 17 
illustrates the results of the dynamic envelope 
calculation procedure for the GTM model with 
increasing wing damage extents, which is 
expressed as the percentage of the wing tip 
removed (100% damage is equivalent to the entire 
left/right wing panel removed). In this result, the 
minimum flight speed has been determined as 
required for maintaining steady level trimmed 
flight, providing representative results illustrating 
the effects of wing damage on the minimum flight 
speed envelope. As the wing damage extent is 
progressively increased, it is necessary to apply 
aileron to counter the asymmetric roll moment on 
the aircraft. For small damage extents, the required 
aileron input is well within the control margin so 
that the minimum airspeed is determined by the 

aerodynamic stall limit, which was applied in this calculation by limiting the aircraft angle of attack. As the wing 
damage extent is increased, maintaining level trimmed flight is limited by the aileron control capability, which 
occurs for damage extents greater than 30%. Level trimmed flight conditions can be maintained by higher flight 
velocities, although allowance for non-zero sideslip angles will also affect the minimum flight speed. As noted in 
Ref. 27, the envelope for safe landing subject to wing damage is bounded by stall, roll control, and landing speed 
requirements; the boundary shown in Fig. 17 considers all but the landing speed operational limit. 

Note that the wing damage minimum flight speed envelope in Fig. 17 has been determined assuming all lateral 
control is available for maintaining trimmed flight. Thus, this boundary is overly optimistic, and in general, control 
margin should be included for maneuvering and/or gust rejection. Envelope restrictions due to horizontal tail 
damage also have been examined, and it was found that damage to the stabilizer does not introduce additional 
performance or controllability limits as with the case of wing damage. While horizontal tail loss requires an 
increase in the required elevator and introduces an asymmetric condition that must be balanced by aileron/rudder 
deflections, no additional state/control limits are approached other than low speed stall limits. Consideration of 
stability limits (i.e., static margins and damping) has not been factored into the present analytical results, although 
these limits can be incorporated into the analysis as additional inequality constraints. 

Determination of dynamic flight envelope limits as described above is computationally intensive, and direct 
calculation of these limits may be incompatible within an on-board envelope estimation system. Given that these 
envelope reductions may be parameterized (i.e., determined as a function of wing/tail surface damage extents), an 
on-board system can be implemented using pre-computed maps that are used in conjunction with an on-board 
detection system to identify and diagnose the nature and extent of aircraft aerodynamic performance degradation. 
These aspects are discussed in more detail in the following section. 


E. Generalized Aerodynamic Performance Degradation Detection 

On-board estimation of envelope restrictions subject to system/subsystem degradation by means of direct 
calculation likely will require parameterization of potential envelope restrictions in terms of physical metrics, such 
as wing damage extent as illustrated in the previous section. Thus, implementation of an on-board envelope (limit) 
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estimation system can be reduced to identifying and quantifying the degradation location and extent with an 
algorithmic approach. 

Use of the detection filter approach has been proven to be an effective technique for failure detection and 
isolation when the desired fault modes can be expressed as additive disturbances to the system. Its application, 
however, becomes more complicated when the failures to be isolated are parametric variations in the system 
dynamics (i.e., multiplicative disturbances, Ref. 6). This complication arises for the case of aircraft lifting surface 
damage detection and isolation. Furthermore, relating the detection filter output (residuals) to the physical damage 
extent may not be straightforward. For these reasons, an alternative approach to aerodynamic performance 
monitoring and degradation detection has been considered. 

A generalized aerodynamic performance degradation monitoring scheme, specifically one that can diagnose 
degradation sufficiently to permit estimation of flight envelope restrictions, has been investigated. To provide a 
direct relationship with the physical mechanisms (e.g., controllability margins) affecting the flight envelope 
boundaries, a reasonable starting point in formulating a detection scheme is derived from the aerodynamic loading 
applied to the aircraft during flight. A notional aerodynamic performance monitoring system is illustrated 
schematically in Fig. 18. Conceptually, this approach consists of the following steps: 

1. The aircraft state and external loads are estimated from available flight data measurements using a 
nonlinear recursive estimator with augmented states representing the aircraft forces and moments. 

2. Since the external forces include both aerodynamic and propulsive loads, propulsive forces (engine 
thrust) are removed from the estimated loads, which can be determined from monitored engine 
parameters, which is a common approach for flight data analysis 30 . 

3. The aircraft state estimate is used to determine the ideal aerodynamic forces/moments based on a non- 
degraded reference model, based on conventional stability derivatives or the distributed loading model 
formulation. 

4. Aerodynamic degradation is determined by examining the difference between the estimated and 
reference model loads. Differences between estimated and reference model loads (referred to as 
residual loads) provide an indication of the degradation location and extent. This approach is 
conceptually similar to a model-based monitoring system for detecting thruster leakage failures in a 
spacecraft application 3 1 . 

5. The output from the detection scheme is a residual vector that provides an indication of the aircraft 
aerodynamic degradation source and extent. This residual output is structured to be correlated with 
physical parameters characterizing the aerodynamic degradation so that pre- determined flight envelope 
limits may be imposed. 


To detect aerodynamic degradation and to provide a method to relate output from the detection scheme to 
physical parameters characterization the degradation source, it was necessary to focus on the approach used for 
residual generation. In particular, the preferred residual generation scheme would ideally show reduced sensitivity 
to variations in the aircraft state. A residual generation scheme has been developed that adopts a “geometric” 


Control/actuator 



Dynamic 

envelope 

limits 


Figure 18. Schematic Illustration of Generalized Aerodynamic Performance Monitoring and Degradation 
Detection/Isolation Method. 
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approach loosely based on one interpretation of the FDF (UDF) design approach. The approach used determines the 
residual vector components based on the residual loads, which allows the output to be correlated with the physical 
source of degradation. 

The aerodynamic degradation/residual generation scheme was applied to the identification of wing and 
horizontal tail damage extents based on flight measurements. The residual generation output was given as two 
residuals (indicated as and r 2 ), which may be used to infer the damage location and extent. Concept evaluations 
were performed using the simulation model described previously. Results are shown with this detection scheme in 
Fig. 19 for simulations of horizontal tail damage. For results given in Fig. 19 (as well as Figs. 20 and 21), the line 
type is used to denote the residual vector component response while the line color is used to denote the damage 
extent. Also shown in Fig. 19 are the corresponding angle of attack time histories (again these simulations have 
been performed with no corrective inputs made, which generally results in larger angle of attack excursions than if a 
pilot were in the simulation loop). Examination of the simulation results shows that the r 2 residual maintains a 
nearly constant value during tail damage scenarios that is independent of the damage extent, while the r! residual 
increases proportionally with damage extent. For wing damage simulations (Fig. 20), the opposite behavior is 
observed where the r, residual remains fixed and the r 2 residual increases with damage extent. Figure 21 also shows 
that damage to the opposite wing results in a sign change of the r! residual while the magnitude of the residuals 
remains unchanged for identical wing damage extents. 

The magnitude of the r! and r 2 residuals during degraded conditions is such that simple logic may be used to 
diagnose both the damage location (left/right wing or horizontal tail) and damage extent. Although it has not been 
considered directly, it is anticipated that vertical tail damage may be incorporated by including a third residual 
output. Additional considerations for implementation in an on-board system are discussed below. 
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Figure 19. Aircraft Damage Detection and Diagnostic Algorithm Output and Corresponding Angle of 
Attack Response for Simulated Tail Damage Scenarios. 




Figure 20. Aircraft Damage Detection and Diagnostic Algorithm Output and Angle of Attack Response for 
Simulated Left Wing Damage Scenarios. 
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Figure 21. Aircraft Damage Detection and Diagnostic Algorithm Output and Angle of Attack Response for 
Simulated Right Wing Damage Scenarios. 

F. On-board Implementation Considerations 

On-board implementation of the aerodynamic performance/degradation monitor requires an estimator for 
determining the applied (aerodynamic) loads on the aircraft, which feeds the residual generation process used for 
fault detection and isolation. Estimation of the aircraft state and aerodynamic forces/moments can be performed 
using a nonlinear, model-based recursive estimator with an augmented state model including aircraft motion states 
in combination with additional states for the forces and moments. An approach such as this is not uncommon, 
having been used previously in aircraft system identification studies (e.g., the Estimation-Before-Modeling 
method 32 ). 

Initial evaluations used an extended Kalman filter (EKF) for the nonlinear state/loads estimation. In general, 
performance of the EKF estimator is sensitive to many aspects of the model formulation and assumed statistical 
properties of the system disturbance and noise. Representation of aircraft attitude presents another aspect of the 
EKF implementation. The EKF formulation for initial investigations used Euler angles for aircraft attitude, resulting 
in an 18 th order model including aircraft inertial position (3 states), inertial velocity (3 states), Euler angle vector 
(3 states), and body-axis angular rates (3 states). The state vector was augmented by the specific forces and 
moments on the aircraft (6 states), which are modeled as first-order Gauss-Markov processes. Since specific 
moments were including in the estimator, the state propagation was nonlinear to account for the rigid body inertial 
couplings. The extended Kalman filter was implemented using a continuous-discrete update algorithm where state 
and covariance propagation was performed using a continuous model while measurement updates were done as a 
discrete, sampled-data process 33 . This approach permitted measurement updates at different rates, which was 
needed for the current application. 

The EKF -based nonlinear estimator was coupled with the aerodynamic degradation detection scheme to provide 
an assessment of the overall system performance in an application representative of an on-board envelope estimation 
system. Simulations have been performed to evaluate the residual generation/detection scheme using noise 
contaminated vehicle response measurements with (simulated) sensor output representative of a modem commercial 
transport aircraft. Parameters for the simulation measurement model (i.e., measurement rates and accuracies) were 
chosen to be representative of a commercial IMU/GPS system based on separate flight test results. Results showing 
the performance of the residual generation/detection scheme using estimated loads are shown in Figs. 22 through 24, 
which illustrate the residual output based on an “ideal” reference model, i.e., aerodynamic loads are determined 
using the distributed loading model with simplified (and corrected) momentum inflow model driven by the tme 
aircraft states. Figure 22 presents the residual generation/detection scheme output using estimated loads and ideal 
reference model for 40% wing tip loss damage scenario. The residual vector components, denoted by solid lines, 
show the presence of noise contamination, but the trends track the theoretical response (shown by the dashed lines in 
Fig. 22). Note that the r! residual component, which maintains a constant value for wing damage, shows less noise 
sensitivity than the r 2 residual. This characteristic is highly desirable from a fault detection/isolation perspective 
(i.e., it is more important to isolate the damage location first prior to determining the damage extent). Similar results 
are shown in Figs. 23 and 24 illustrating horizontal tail damage scenarios. Again, the presence of noise 
contamination can be seen, but the residual components track the theoretical trends. 
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Figure 22. Residual Generation/Detection Scheme Output for Wing Damage Scenario (40% Left Tip Loss), 
EKF Estimated Loads and Ideal Reference Model. 
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Figure 23. Residual Generation/Detection Scheme Output for Horizontal Tail Damage Scenario (80% Left 
Tip Loss), EKF Estimated Loads and Ideal Reference Model. 



Figure 24. Residual Generation/Detection Scheme Output for Horizontal Tail Damage Scenario (40% Left 
Tip Loss), EKF Estimated Loads and Ideal Reference Model. 
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These results show promise of the aerodynamic performance degradation detection/isolation methods described 
previously. Note that the “glitch” observed in the r 2 residual component response at approximately 1 1 seconds into 
the simulation shown in Figure 22 can be traced to the EKF output and is caused by tracking of the heading 
measurement, which switches from -180 to 180 degrees. Simulation results using the estimated states in the 
reference model calculation indicated deterioration in detection performance, which can also be traced back to the 
presence of inconsistencies in the state estimated. These issues indicate that detection performance may be 
improved with an alternative nonlinear estimation scheme. Work is continuing to evaluate measurement signal-to- 
noise sensitivity on the ability to perform fault detection/isolation using the generalized scheme. In addition, the 
application of robust residual generation methods 6 should provide a method to further reduce the sensitivity to 
measurement noise. These extensions will be addressed in future work. 

V. Concluding Remarks 

This paper describes methods for identifying aerodynamic performance degradation and assessing the impacts of 
degradation on the dynamic flight envelope, with emphasis placed on the on-board implementation of the envelope 
estimation system. Such a system notionally would perform outer-loop supervision for an aircraft to augment 
adaptive/envelope limiting control systems and/or to provide inputs for intelligent guidance flight directors to 
provide safe landing in the presence of aircraft impairment (e.g., failed control surfaces, lifting surface damage, and 
icing). Results are provided that demonstrate elements of the overall envelope estimation system and highlight areas 
for further development leading to an on-board system implementation and demonstration. 

Determination of the aircraft flight envelope, including accounting for the effects of aerodynamic performance 
degradation, can be performed using analytical methods outlined in this paper. Computational requirements, 
however, are such that any operational limits due to aerodynamic degradation need to be evaluated parametrically 
when implementing an on-board envelope estimation system. Thus, an essential element for implementation of an 
on-board system is the development of methods for the detection of aerodynamic degradation that may be correlated 
with physical parameters. Model-based fault detection methods, such as the FDF, provide one approach to identify 
and isolate both component failures and performance degradation, including the onset of upset conditions as shown 
through evaluations with flight test data for a small unmanned aircraft. Requirements for an on-board envelope 
estimation system have led to the investigation of a generalized approach for aerodynamic performance degradation 
detection. This generalized approach has been applied to the detection of wing/tail lifting surface damage. Results 
presented in this paper show promise of the generalized approach for isolating wing/tail damage extents, as shown 
through evaluations with simulated noise contaminated measurements. Further developments are required to 
improve noise robustness properties of the detection scheme. 
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